Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759997AbcCDSRa (ORCPT ); Fri, 4 Mar 2016 13:17:30 -0500 Received: from mga09.intel.com ([134.134.136.24]:63681 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759193AbcCDSRX (ORCPT ); Fri, 4 Mar 2016 13:17:23 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,536,1449561600"; d="scan'208";a="929778838" From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org Cc: Dave Hansen , Andy Lutomirski , Borislav Petkov , Sai Praneeth Prakhya , "Ravi V. Shankar" , Fenghua Yu , Yu-cheng Yu Subject: [PATCH v4 07/10] x86/xsaves: Fix PTRACE frames for XSAVES Date: Fri, 4 Mar 2016 10:12:36 -0800 Message-Id: <46ff4951eef7e9ad30b25df401fa536a5bc9100b.1457038929.git.yu-cheng.yu@intel.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 8854 Lines: 315 XSAVES uses compacted format and is a kernel instruction. The kernel should use standard-format, non-supervisor state data for PTRACE. Signed-off-by: Yu-cheng Yu --- arch/x86/include/asm/fpu/xstate.h | 4 + arch/x86/kernel/fpu/regset.c | 56 +++++++++--- arch/x86/kernel/fpu/xstate.c | 173 +++++++++++++++++++++++++++++++++++++- 3 files changed, 217 insertions(+), 16 deletions(-) diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h index b4f5d94..a5cd808 100644 --- a/arch/x86/include/asm/fpu/xstate.h +++ b/arch/x86/include/asm/fpu/xstate.h @@ -50,5 +50,9 @@ extern void update_regset_xstate_info(unsigned int size, u64 xstate_mask); void fpu__xstate_clear_all_cpu_caps(void); void *get_xsave_addr(struct xregs_state *xsave, int xstate); const void *get_xsave_field_ptr(int xstate_field); +int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf, + void __user *ubuf, const struct xregs_state *xsave); +int copyin_to_xsaves(const void *kbuf, const void __user *ubuf, + struct xregs_state *xsave); #endif diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c index 0bc3490..61fe8e9 100644 --- a/arch/x86/kernel/fpu/regset.c +++ b/arch/x86/kernel/fpu/regset.c @@ -4,6 +4,7 @@ #include #include #include +#include /* * The xstateregs_active() routine is the same as the regset_fpregs_active() routine, @@ -82,21 +83,30 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset, if (!cpu_has_xsave) return -ENODEV; + xsave = &fpu->state.xsave; + fpu__activate_fpstate_read(fpu); - xsave = &fpu->state.xsave; + if (boot_cpu_has(X86_FEATURE_XSAVES)) { + ret = copyout_from_xsaves(pos, count, kbuf, ubuf, xsave); + } else { + fpstate_sanitize_xstate(fpu); + + /* + * Copy the 48 bytes defined by the software into the xsave + * area in the thread struct, so that we can copy the whole + * area to user using one user_regset_copyout(). + */ + memcpy(&xsave->i387.sw_reserved, + xstate_fx_sw_bytes, sizeof(xstate_fx_sw_bytes)); + + /* + * Copy the xstate memory layout. + */ + ret = user_regset_copyout(&pos, + &count, &kbuf, &ubuf, xsave, 0, -1); + } - /* - * Copy the 48bytes defined by the software first into the xstate - * memory layout in the thread struct, so that we can copy the entire - * xstateregs to the user using one user_regset_copyout(). - */ - memcpy(&xsave->i387.sw_reserved, - xstate_fx_sw_bytes, sizeof(xstate_fx_sw_bytes)); - /* - * Copy the xstate memory layout. - */ - ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, xsave, 0, -1); return ret; } @@ -111,11 +121,29 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, if (!cpu_has_xsave) return -ENODEV; - fpu__activate_fpstate_write(fpu); + /* + * A whole standard-format XSAVE buffer is needed. + */ + if ((pos != 0) || (count < user_xstate_size)) + return -EFAULT; xsave = &fpu->state.xsave; - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1); + fpu__activate_fpstate_write(fpu); + + if (boot_cpu_has(X86_FEATURE_XSAVES)) + ret = copyin_to_xsaves(kbuf, ubuf, xsave); + else + ret = user_regset_copyin(&pos, + &count, &kbuf, &ubuf, xsave, 0, -1); + + /* + * In case of failure, mark all states as init. + */ + + if (ret) + fpstate_init(&fpu->state); + /* * mxcsr reserved bits must be masked to zero for security reasons. */ diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index aaab0d3..b9d4d59 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -677,7 +677,13 @@ void __init fpu__init_system_xstate(void) return; } - update_regset_xstate_info(kernel_xstate_size, xfeatures_mask); + /* + * Update info used for ptrace frames; use standard-format size and no + * supervisor xstates. + */ + update_regset_xstate_info(user_xstate_size, + xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR); + fpu__init_prepare_fx_sw_frame(); setup_init_fpu_buf(); setup_xstate_comp(); @@ -701,6 +707,15 @@ void fpu__resume_cpu(void) } /* + * Get an xstate component address for either kernel or user mode. + */ +static void *get_xsave_addr_no_check(const struct xregs_state *xsave, + int feature_nr) +{ + return (void *)xsave + xstate_comp_offsets[feature_nr]; +} + +/* * Given the xsave area and a state inside, this function returns the * address of the state. * @@ -748,7 +763,7 @@ void *get_xsave_addr(struct xregs_state *xsave, int xstate_feature) if (!(xsave->header.xfeatures & xstate_feature)) return NULL; - return (void *)xsave + xstate_comp_offsets[feature_nr]; + return get_xsave_addr_no_check(xsave, feature_nr); } EXPORT_SYMBOL_GPL(get_xsave_addr); @@ -783,3 +798,157 @@ const void *get_xsave_field_ptr(int xsave_state) return get_xsave_addr(&fpu->state.xsave, xsave_state); } + +/* + * This is similar to user_regset_copyout(), but will not add offset to + * the source data pointer or increment pos, count, kbuf, and ubuf. + */ +static inline int xstate_copyout(unsigned int pos, unsigned int count, + void *kbuf, void __user *ubuf, + const void *data, const int start_pos, + const int end_pos) +{ + if ((count == 0) || (pos < start_pos)) + return 0; + + if (end_pos < 0 || pos < end_pos) { + unsigned int copy = + (end_pos < 0 ? count : min(count, end_pos - pos)); + + if (kbuf) + memcpy(kbuf + pos, data, copy); + else if (__copy_to_user(ubuf + pos, data, copy)) + return -EFAULT; + } + return 0; +} + +/* + * Convert from kernel XSAVES compacted format to standard format and copy + * to a ptrace buffer. It supports partial copy but pos always starts from + * zero. This is called from xstateregs_get() and there we check the cpu + * has XSAVES. + */ +int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf, + void __user *ubuf, const struct xregs_state *xsave) +{ + unsigned int offset, size; + int ret, i; + struct xstate_header header; + + /* + * Currently copy_regset_to_user() starts from pos 0. + */ + if (unlikely(pos != 0)) + return -EFAULT; + + /* + * The destination is a ptrace buffer; we put in only user xstates. + */ + memset(&header, 0, sizeof(header)); + header.xfeatures = xsave->header.xfeatures; + header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR; + + /* + * Copy xregs_state->header. + */ + offset = offsetof(struct xregs_state, header); + size = sizeof(header); + + ret = xstate_copyout(offset, size, kbuf, ubuf, &header, 0, count); + + if (ret) + return ret; + + for (i = 0; i < XFEATURE_MAX; i++) { + /* + * Copy only in-use xstates. + */ + if (((header.xfeatures >> i) & 1) && xfeature_enabled(i)) { + void *src = get_xsave_addr_no_check(xsave, i); + + offset = xstate_offsets[i]; + size = xstate_sizes[i]; + + ret = xstate_copyout(offset, size, kbuf, ubuf, src, 0, + count); + + if (ret) + return ret; + + if (offset + size >= count) + break; + } + } + + /* + * Fill xsave->i387.sw_reserved value for ptrace frame. + */ + offset = offsetof(struct fxregs_state, sw_reserved); + size = sizeof(xstate_fx_sw_bytes); + + ret = xstate_copyout(offset, size, kbuf, ubuf, xstate_fx_sw_bytes, 0, + count); + + if (ret) + return ret; + + return 0; +} + +/* + * Convert from a ptrace standard-format buffer to kernel XSAVES format + * and copy to the target thread. This is called from xstateregs_set() and + * there we check the cpu has XSAVES and a whole standard-sized buffer + * exists. + */ +int copyin_to_xsaves(const void *kbuf, const void __user *ubuf, + struct xregs_state *xsave) +{ + unsigned int offset, size; + int i; + u64 xfeatures; + + offset = offsetof(struct xregs_state, header); + size = sizeof(xfeatures); + + if (kbuf) + memcpy(&xfeatures, kbuf + offset, size); + else if (__copy_from_user(&xfeatures, ubuf + offset, size)) + return -EFAULT; + + /* + * Reject if the user tries to set any supervisor xstates. + */ + if (xfeatures & XFEATURE_MASK_SUPERVISOR) + return -EINVAL; + + for (i = 0; i < XFEATURE_MAX; i++) { + u64 mask = ((u64)1 << i); + + if ((xfeatures & mask) && xfeature_enabled(i)) { + void *dst = get_xsave_addr_no_check(xsave, i); + + offset = xstate_offsets[i]; + size = xstate_sizes[i]; + + if (kbuf) + memcpy(dst, kbuf + offset, size); + else if (__copy_from_user(dst, ubuf + offset, size)) + return -EFAULT; + } + } + + /* + * The state that came in from userspace was user-state only. + * Mask all the user states out of 'xfeatures'. + */ + xsave->header.xfeatures &= XFEATURE_MASK_SUPERVISOR; + + /* + * Add back in the features that came in from userspace. + */ + xsave->header.xfeatures |= xfeatures; + + return 0; +} -- 1.9.1